Submission: You should submit your answers to Questions 1 and 3 on paper. You should also use the automatic submission server to submit a single Scheme Definition file (your ps4.rkt) including all of the code you wrote. If you are able to pass all the automated tests, you do not need to submit your code on paper for this assignment. If you are not able to pass all the tests, you should also turn in a printout of your code to receive partial credit.

Collaboration Policy – Read Carefully

This problem set is intended to help you prepare for Exam 1. You may work on it by yourself or with any number of other students of your choice, but keep in mind that you will need to do the exam on your own.

Regardless of whether you work alone or not, you are encouraged to discuss this assignment with other students in the class and ask and provide help in useful ways. Remember to follow the pledge you read and signed at the beginning of the semester. For this assignment, you may consult any outside resources, including books, papers, web sites and people, you wish except for materials from previous cs1120, cs150, and cs200 courses. If you use resources other than the class materials, lectures and course staff, explain what you used in your turn-in.

As always, you are strongly encouraged to take advantage of the scheduled help hours and office hours for this course.

Purpose

Get more practice with some of the material that will be on Exam 1 including: recursive definitions, procedures, and lists.

Gain understanding of how machines can compute, and Turing’s model of a computer.

Learn about cryptography and the first problems that were solved by computers.

Background

Cryptography means secret writing. The goal of much cryptography is for one person to send a message to another person over a channel that an adversary may be eavesdropping on without the eavesdropper understanding the message. We do this by having functions that encrypt and decrypt messages.

The encrypt function takes a plaintext (unencrypted) message and produces a ciphertext (encrypted) message. Encrypt scrambles and alters the letters of the plaintext message so that an eavesdropper who intercepts the message would not be able to understand its meaning. The decrypt function takes a ciphertext message and produces the corresponding plaintext message. Encryption works as intended if the only person who can perform the decrypt function is the intended recipient of the message.

Since making up good encrypt and decrypt functions and keeping them secret is hard, most cryptosystems are designed to be secure even if the encryption and decryption algorithms are revealed. The security relies on a key which is kept secret and known only to the sender and receiver. The key alters the encryption and decryption algorithm in some way that would be hard for someone who doesn’t know the key to figure out. If the sender and receiver use the same secret key we call it a symmetric cipher. If the sender and receiver can use different keys we call it an asymmetric cipher (asymmetric ciphers are also known as public-key cryptosystems).

In this problem set, you will explore a symmetric cipher based on the Lorenz Cipher that was used by the German Army High Command to send some of the most important and secret messages during World War II. The Lorenz Cipher was broken by British Cryptographers at Bletchley Park.
Arguably the first electronic programmable computer, Colossus, was designed and built by Tommy Flowers, a Post Office engineer working at Bletchley Park during the war. (There is a lot of arguing about what should be considered the first computer. Babbage's Analytical Computer would be the first, except he was not able to actually build it. Konrad Zuse's built the first working universal computer, but had the misfortune of working in Nazi Germany. Who Invented the Computer? The Legal Battle That Changed Computing History supports John Atanasoff's case; this Scientific American post summarizes some of the other candidates.)

Ten Collosi were built in 1943 and 1944, and used to break some of the most important German messages during World War II. Messages broken by Colossus were crucial to the D-Day invasion since the allies were able to learn that their campaign to deceive Hitler about where the attack would come was succeeding and knew where German troops were positioned.

It is regretted that it is not possible to give an adequate idea of the fascination of a Colossus at work: its sheer bulk and apparent complexity; the fantastic speed of thin paper tape round the glittering pulleys; the childish pleasure of not-not, span, print main heading and other gadgets; the wizardry of purely mechanical decoding letter by letter (one novice thought she was being hoaxed); the uncanny action of the typewriter in printing the correct scores without and beyond human aid; the stepping of display; periods of eager expectation culminating in the sudden appearance of the longed-for score; the strange rhythms characterizing every type of run; the stately break-in, the erratic short run, the regularity of wheel-breaking, the stolid rectangle interrupted by the wild leaps of the carriage-return, the frantic chatter of a motor run, the ludicrous frenzy of hosts of bogus scores.

Download: Download ps4.zip to your machine and unzip it into your cs1120 directory.

This file contains:

ps4.rkt — A template for your answers. You should do the problem set by editing this file.

lorenz.rkt — Some helpful definitions for this problem set.

ch5-code.rkt — List procedures from Chapter 5.

The Exclusive Or (XOR)

The exclusive-or (xor, sometimes pronounced "zor") function is one of the most useful functions for cryptography. The xor function evaluates to true if exactly one of the inputs is true, and evaluates to false otherwise. (Note that in informal English, people often use or to me xor, not logical or. For example, a statement like, "Saturday I'm going to work on my cs1120 problem set OR go to the soccer game." really means "Saturday I'm going to work on my cs1120 problem set XOR go to the soccer game." unless doing both is really intended to be an option.)

Question 1: (Turn in on paper) Design a machine that can compute the exclusive-or of two inputs. Your machine can use the normal control and inverted control transistors we introduced in class. Students who do not want to rely on the magic of transistors, can design a machine that uses liquid with floats and basins, like the machines in Chapter 6 of the course book. It is not expected that you will implement your machine, but demonstrating a working XOR-machine that operates using single malt Scotch would definitely be worth a gold star bonus; underage students can substitute a suitable non-alcholic beverage.

Note [added 29 Sept]: When you draw your machine, it is fine to draw the NOT and AND operations as simple boxes, instead of transistors. Your NOT box should have one input and one output; your AND box should have two inputs and one output.

In cryptography, it is usually easier to deal with 1 and 0 instead of true and false. For this problem set, use 1 to represent true and 0 to represent false. Each 0 or 1 represents one bit of information.

Question 2: Define an xor-bits function (Scheme procedure) that takes two bits as parameters and evaluates to 1 if exactly one of the parameters is 1 and evaluates to 0 otherwise. (Note that this function is slightly different from the one defined in Chapter 6, since the inputs are not Booleans.)

Your xor-bits function should produce these evaluations:

> (xor-bits 0 0)0> (xor-bits 0 1)1

> (xor-bits 1 0)1> (xor-bits 1 1)0

The xor function has two properties that make it the most important function in cryptography:

invertibility — (xor (xor ab) b) always evaluates to a, no matter what b is. This means if we encrypt a message by xor-ing it with a key, we can decrypt the message by using xor again with the same key!

perfect secrecy — if a is a message bit and r is a perfectly random bit (fifty percent chance it is true and fifty percent chance it is false), then (xor ar) is equally likely to be true or false regardless of the message bit a.

The second property means that if a message is encrypted by converting the message into a sequence of bits, and xor-ing each bit in the message with a perfectly random, secret bit known only to the sender and receiver, then we can send a message with perfect secrecy! This is known as a one-time pad. As described in Chapter 7 of The Information, Claude Shannon proved that a one-time pad provides perfect secrecy. Although Shannon was the first person to understand why the one-time pad was so effective, it was used as early as 1882.

Fortunately for the allies, the Nazis didn't have a way of generating and distributing perfectly random bit sequences. Instead, they generated non-random sequences of bits using rotors. Because the sequences of bits used as the key were not random, the cryptographers at Bletchley Park were able to figure out a way to determine the most likely key, and hence, to decrypt the message. We'll talk more about how they did this in class (but it is not necessary to understand to complete this problem set).

(Historical aside: The Soviet Union also used a one-time pad cipher following WWII. Because they sometimes reused keys and made some mistakes in constructing the keys, however, the NSA was able to decrypt many important KGB messages. Details of this were released in 1995, and are available at the NSA's web site. The decrypted messages were used to expose Julius and Ethel Rosenberg's spy ring, as well as Soviet attempts to obtain atomic weapons research.)

We will look at how the Lorenz cipher used xor to encrypt messages soon. First, we consider how to turn messages into sequences of bits.

Question 3: (Turn in on paper) Design a Turing Machine that computes the bitwise XOR of two input sequences. The input is a tape containing a string in the language described by this BNF grammar:

When your machine reaches the Halt state, the tape should contain BitSeq# (its okay if there is more stuff to the right of the #) where the output BitSeq is the XOR of the two inputs. For example, if the input is 0110+1111# the output should be 1001#. If the two input sequences are of different lengths, your machine should end in an Error state.

Your answer should show the design of a Turing Machine that solves the problem. The fewer states you use in your answer, the better.

Note: It is not necessary to complete this problem before going on to the rest of the problem set. You may prefer to come back to this question later after finishing the Scheme programming questions.

Note [added 29 Sept]: If you prefer to have a # at the beginning of the input and output, that is fine (and may make it a bit easier to design the machine). With this change, your rule for Input is Input ::= #BitSeq+BitSeq#.

The Baudot Code

The code used by the Nazis was the Baudot code. It translates letters and other common characters into a 5 bit code. With five bits, we have 25 = 32 possible values, so this is enough to give each letter in the alphabet a different code and have a few codes left over for spaces and other symbols. Modern computers typically used either 7-bit ASCII encodings to have 27 = 128 possible characters so that lowercase and additional punctuation characters can be represented, or 16-bit Unicode encodings that are able to represent 216 = 65536 different characters to support languages like Chinese that have many different characters.

Table 1 shows the letter mappings for the Baudot code. For example, the letter H is represented by 10100 while I is 00110. We can put letters together just by concatenating their encodings. For example, the string "HI" is represented in Baudot as 10100 00110. There are some values in the Baudot code that are awkward to print: carriage return, line feed, letter shift, figure shift and error. For our purposes we will use printable characters unused in the Baudot code to represent those values so we can print encrypted messages as normal strings. Table 1 shows the replacement values in parenthesis.

A

00011

H

10100

O

11000

V

11110

space

00100

B

11001

I

00110

P

10110

W

10011

carriage return (,)

01000

C

01110

J

01011

Q

10111

X

11101

line feed (-)

00010

D

01001

K

01111

R

01010

Y

10101

letter shift (.)

11111

E

00001

L

10010

S

00101

Z

10001

figure shift (!)

11011

F

01101

M

11100

T

10000

error (*)

00000

G

11010

N

01100

U

00111

Table 1. Baudot Code mappings.

We use lists of ones and zeros to represent Baudot codes. H is represented as (list 1 0 1 0 0). A string is represented as a list of these lists: "HI" is (list (list 1 0 1 0 0) (list 0 0 1 1 0)).

We have provided these two functions in lorenz.rkt:

char-to-baudot: Character → Baudot

Takes a character as input, and outputs the corresponding Baudot code represented as a list of five bits.

baudot-to-char: Baudot → Character

Takes a Baudot code, represented as a list of five bits, as input and outputs the corresponding character.

Characters are represented in DrRacket using #\character. For example, #\H is the character H and #\space is the space character.

There are two useful built-in procedures for converting between a string and a list of characters:

string->list: String → List

Takes a String as input and outputs the corresponding List of Characters.

list->string: List → String

Takes a List of Characters as input and outputs the corresponding String.

For example:

> (string->list "HI")
(#\H #\I)
> (list->string (list #\H #\I))
"HI"

Question 4:a. Define a procedure, string-to-baudot, that takes a string and transforms it into a list of Baudot codes. b. Write the inverse function, baudot-to-string, that takes a list of lists of baudot codes and transforms it back into a string.

Your functions should be inverses. Hence, you can test your code by evaluating baudot-to-string composed with string-to-baudot. For example, (baudot-to-string (string-to-baudot "HELLO"))
should evaluate to "HELLO".

Lorenz Cipher Machine

The Lorenz Cipher

The Lorenz cipher was an encryption algorithm developed by the Germans during World War II. It was used primarily for communications between high commanders in European capitals controlled by the Nazis. The original Lorenz machine consisted of 12 wheels, each one having 23 to 61 unique positions. Each position of a wheel represented either a one or a zero.

The first 5 wheels were called the K wheels. Each bit of the Baudot representation of a letter was xor-ed with the value showing on the respective wheel. The same process was repeated with the next 5 wheels, named the S wheels. The resulting value represented the encrypted letter.
After each message letter the K wheels turn one rotation. The movement of the S wheels was determined by the positions of the final two wheels, called the M wheels.

Like all good ciphers, the Lorenz machine uses a key to control the encryption and decryption functions. The key was the starting position of each of the 12 wheels. To decipher the message you simply need to start the wheels with the same position as was used to encrypt and enter the ciphertext.

Lorenz Cipher Wheels

There are 16,033,955,073,056,318,658 possible starting positions (this is about the number of transistors we should expect Intel to sell in 2022). This made the Nazis very confident that without knowing the key (starting positions of the wheels), no one would be able to break messages encrypted using the Lorenz machine. (As we will see, however, they did not account for the cleverness of the Bletchley Park cryptographers and machine designers!)

For this problem set, you will simulate a simplified version of the Lorenz cipher (dealing with the full Lorenz cipher is left as a bonus problem). You should be suitably amazed that the allied cryptographers in 1943 were able to build a computer to solve a problem that is still hard for us to solve today! (Of course, they did have more that a week to solve it, and a much more serious motivation than we can provide in this course.)

Our Lorenz machine will use 11 wheels, each with only 5 positions. The first five wheels will be the K wheels and the second five the S wheels. Each of these will only have a single starting position for all 5. Unlike the real Lorenz machine, for this problem set we will assume all five K wheels must start at the same position and all five S wheels must start at the same position.

The final wheel will act as the M wheel. After each letter all the K wheels and the M wheel should rotate. If the M wheel shows a 1 the S wheels should also rotate, but if the M wheel shows a 0 the S wheels do not rotate.

We have provided 3 lists that represent the wheels. The first is called K-wheels and is a list of lists, each of the inner lists containing the 5 settings. The definition is:

There is a similar list called S-wheels to represent the S wheels of our simulated machine.

The final list represents the M wheels and is just a single list. The definition is:

(define M-wheel (list 0 0 1 0 1))

The first number in the list represents the current position of the wheel. Thus, we can simulate rotating a wheel by removing the number at the front of the list and placing it at the back.

Question 5: Define a procedure rotate-wheel that takes as input a wheel (which is a represented as a list). It should return the wheel rotated once. For example, (rotate-wheel (list 1 0 0 1 0)) should evaluate to (0 0 1 0 1). Although all the wheels in our simulated Lorenz cipher machine have five bits, your rotate-wheel procedure should work for any non-empty list.

We also want a procedure that can rotate a wheel zero or more times.

Question 6: Define a procedure rotate-wheel-by that takes two inputs: a wheel as the first input and a number as the second. It should output result of rotating the wheel the number of times passed in. For example, (rotate-wheel-by (list 1 0 0 1 0) 2) should evaluate to (0 1 0 1 0) and (rotate-wheel-by wheel 0) should evaluate to wheel.

Next, define similar procedures that work on a list of wheels at a time instead of a single wheel.

Question 7: Define a procedure rotate-wheel-list that takes a list of wheels (like K-wheels) as its input and evaluates to a list of wheels where each of the wheels in the parameter list of wheels has rotated once. For example, (rotate-wheel-list K-wheels) should evaluate to ((1 0 1 0 1) (1 0 0 1 0) (0 0 1 0 1) (1 1 0 1 1) (0 0 0 1 1)).

Question 8: Define a procedure rotate-wheel-list-by that takes a list of wheels and a number as parameters, and evaluates to a list where each of the wheels in the parameter list of wheels has rotated the number parameter times. For example, (rotate-wheel-list-by K-wheels 5) should evaluate to the same list as K-wheels.

Simulating the Lorenz Machine

Now that we can rotate our wheels, we can simulate the (simplified) Lorenz machine using our K and S wheels. Since both sets of wheels are doing the same thing, we should be able to write one procedure that will work with either the K wheels or the S wheels.

Question 9: Define a function wheel-encrypt that takes a Baudot-encoded letter (a list of 5 bits) and a list of wheels as parameters. The function should xor each bit of the Baudot list with the first value of its respective wheel and return the resulting list. For example, (wheel-encrypt (list 0 0 0 1 1) K-wheels) should produce (1 0 1 0 0). Your wheel-encrypt procedure should have running time in Θ(n) where n is the length of the list passed as the first parameter to wheel-encrypt.

We now have all the procedures we need to implement our simplified Lorenz machine. A quick review of how the machine should work:

Each of the five bits of the Baudot representation of a letter is xored with the current position of the respective K wheels.

The resulting five bits from the previous step are xored with the current position of the respective S wheels to produce the ciphertext.

The K wheels are rotated one position.

The S wheels are rotated one position only if the value at the current position of the M wheel is 1.

The M wheel is rotated one position.

The process is repeated for each letter in the message.

Question 10: Define a function called do-lorenz that takes a list of Baudot values, the K wheels, S wheels and M wheel. The function should encrypt the first Baudot code with the K and S wheels, then recursively encrypt the rest of the Baudot codes with the wheels rotated. The function should return the encrypted values in the form of a list of Baudot values. For example:

Question 11: Define a function lorenz-encrypt that takes four parameters: a string and three integers. The integers represent the starting positions of the three wheels, respectively. The function should call do-lorenz with the string converted to Baudot and the wheels rotated to the correct starting positions. The function should return the ciphertext in the form of a string.

You should now be able to encrypt strings using the simplified Lorenz cipher. To test it, call your lorenz-encrypt function with a string and offsets of your choice to produce ciphertext. Since our encryption and decryption functions are the same, if you evaluate lorenz-encrypt again using the ciphertext and the same offsets you should get your original message back.

For example:

> (lorenz-encrypt "CAKE" 1 2 3)

"BNR!"

> (lorenz-encrypt "BNR!" 1 2 3)

"CAKE"

Cracking the Code

The first Lorenz-encrypted messages were intercepted by the British in early 1940. The intercepts were sent to Bletchley Park, the highly secret British base set up specifically to break enemy codes. The code-breakers at Bletchley Park had little success with the Lorenz Cipher until the Germans made a major mistake in late 1941. A German operator had nearly finished sending a long message using a Lorenz machine when the receiver radioed back to tell him that the message had not been received correctly. The operator then reset his machine back to the same starting position and began sending the message again. But the operator, probably frustrated at having to resend the message, abbreviated some of the words he had typed out completely the first time. This led to two nearly identical messages encrypted using the same starting positions.

The messages were sent to John Tiltman at Bletchley Park. Tiltman was able to discern both messages and determine the generated key. The messages were then passed on to Bill Tutte who, after two months of work, figured out the complete structure of the Lorenz machine only from knowing the key it generated. The British were then able to break the Lorenz codes, but much of the work needed to be done by hand, which took a number of weeks to complete. By the time the messages were decrypted they were mostly useless.

The problem was given to Tommy Flowers, an electronics engineer from the Royal Post Office. Flowers designed and built a device called Colossus that worked primarily with electronic valves. The Colossus was the first electronic programmable computer. It was able to decrypt the Lorenz messages in a matter of hours, a huge improvement from the previous methods. The British built ten more Colossi and were able to decrypt an enormous amount of messages sent between Hitler and his high commanders. The British kept Colossus secret until the 1970s. After the war, eight of the Colossi were quickly destroyed and the remaining two were destroyed in 1960 and all drawings were burnt. The details of the breaking of the Lorenz Cipher were kept secret until 2000, but are now available at http://www.codesandciphers.org.uk/documents/newman/newmix.htm.

Our simplified Lorenz cipher is small enough that it is possible to break encrypted messages just by trying all possible keys until you find the one that works. Since there are only 5 starting positions for the K wheels, 5 for the S wheels, and 5 for the M wheel, there are only 125 different keys. This is such a small number that we can simply try every possibility and look at the results to find the original message. Breaking a cipher by trying all possible key values is called a brute-force attack. A good cipher must have far too many keys for someone to be able to test them all, even with access to the most powerful computers. Typical ciphers today, such as the AES cipher, use a key that is at least 128 bits long (so there are 2128 > 1038 possible keys, which makes the number of transistors Intel sells look like a very small number!)

Question 12: Define a procedure, brute-force-lorenz, that takes two inputs: a procedure and a ciphertext string. Your procedure should evaluate lorenz-encrypt on the ciphertext for all 125 possible starting positions, passing in the resulting string to the input procedure. For example, evaluating

should print out the 125 possible decoded strings for the ciphertext input (defined in lorenz.rkt). If your procedure works correctly, the one message generated that looks like sensible English is the plaintext message.

The challenge-ciphertext message was encrypted using a Lorenz-like cipher, but unlike the ciphertext for Question 12 (and the machine you simulated to solve that), the wheels in each group are not necessarily all rotated by the same amount. So, each of the five K-wheels, each of the five S-wheels, and the one M-wheel can be rotated by any amount. This means instead of having 125 possible initial wheel settings, this machine has 511 = 48828125 possible settings.

Solving this challenge is worth at least a gold star bonus (and potentially multiple gold stars depending on how you solve it), as well as an offer to join my research group (with a paid position over the summer). There is no deadline on submitting a solution to this challenge, whoever solves it first wins. The winner will be expected to explain their solution to me, and present it to the class.

Note: this is definitely a challenging problem, but trivially easy compared to breaking the actual Lorenz cipher as was done at Bletchley Park in 1943, not even accounting for the fact that they had to start by inventing a computer! (Hint: The encrypted message is in English, but you definitely don’t want to look at 48 million output strings by hand to see which one is English!)

Colossus (Original, 1943)

Colossus (Rebuilt, 2004)

Submission: You should submit your answers to Questions 1 and 3 on paper. You should also use the automatic submission server to submit a single Scheme Definition file (your ps4.rkt) including all of the code you wrote. If you are able to pass all the automated tests, you do not need to submit your code on paper for this assignment. If you are not able to pass all the tests, you should also turn in a printout of your code to receive partial credit.

Avail yourself of these means to communicate to us at seasonable intervals a copy of your journal, notes & observations of every kind, putting into cipher whatever might do injury if betrayed.